CVE-2025-40745

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-14 · updated 2026-10-14
Weakness: CWE-295

Description

A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

Affected products

Siemens Simcenter 3D: before 2506.6000 — fixed in 2506.6000
Siemens Simcenter Femap: before 2506.6000 — fixed in 2506.6000
Siemens Simcenter STAR-CCM+ Viewer: before 2602 — fixed in 2602
Siemens Software Center: before 3.5.8.2 — fixed in 3.5.8.2
Siemens Solid Edge Se2025: before 225.0; 225.0, 225.0-update_0001, 225.0-update_0002, 225.0-update_0003, 225.0-update_0004, 225.0-update_0005 (+7) — fixed in 225.0
Siemens Solid Edge SE2026: before 226.0; 226.0, 226.0-update_1, 226.0-update_2, 226.0-update_3 — fixed in 226.0
Siemens Tecnomatix Plant Simulation: before 2504.0008 — fixed in 2504.0008

How to fix

Upgrade to a fixed version: Siemens Simcenter 3D 2506.6000; Siemens Simcenter Femap 2506.6000; Siemens Simcenter STAR-CCM+ Viewer 2602; Siemens Software Center 3.5.8.2; Siemens Solid Edge Se2025 225.0; Siemens Solid Edge SE2026 226.0; Siemens Tecnomatix Plant Simulation 2504.0008. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-981622.html

Get alerted when CVE-2025-40745 or the next vulnerability affects your stack